Data Intelligence Lab@HKU Vibe-Trading path traversal vulnerability

Data Intelligence Lab@HKU Vibe-Trading versions 0.1.0 through 0.1.7 contain a path traversal vulnerability. This flaw stems from improper handling of paths in the LLM agent file reading tool; readdocument lacks proper sandbox checks, and the safeuserpath restriction can be bypassed. As a result,...

Data Intelligence Lab@HKU Vibe-Trading prompt injection vulnerability

In Data Intelligence Lab@HKU Vibe-Trading versions 0.1.0 through 0.1.7, there is a prompt injection vulnerability. This occurs because the agent injects commands into documents or web pages; BashTool and BackgroundRunTool pass the commands generated by the model directly to subprocess.run execute...

Data Intelligence Lab@HKU Vibe-Trading authorization issue vulnerability

In Data Intelligence Lab@HKU Vibe-Trading versions 0.1.0 through 0.1.7, there is an authorization issue vulnerability. This arises because when APIAUTHKEY is not set, requireauth returns early, allowing unauthenticated attackers to access the FastAPI interface. They can post messages via...

Security Bulletin: Vulnerabilities found in Watson Data Intelligence

Summary Multiple Vulnerabilities were addressed in Watson Data Intelligence version 5.3.1 Patch15 Vulnerability Details CVEID:CVE-2026-69153 DESCRIPTION: PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to...

Security Bulletin: Vulnerabilities found in Watson Data Intelligence

Summary Multiple Vulnerabilities were addressed in Watson Data Intelligence version 5.4.0 Patch6 Vulnerability Details CVEID:CVE-2026-59870 DESCRIPTION: js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.1, YAML11SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts use...

Security Bulletin: Vulnerabilities found in Watson Data Intelligence

Summary Multiple Vulnerabilities were addressed in Watson Data Intelligence version 5.3.1 Patch 11 Vulnerability Details CVEID:CVE-2026-41608 DESCRIPTION: Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrif...

IBM Watsonx.Data Intelligence Resource Management Error Vulnerability

IBM WatsonXData Intelligence is a data management and analysis platform provided by American company IBM. There is a resource management vulnerability in IBM WatsonX.Data Intelligence, which stems from uncontrolled resource consumption within the application. Attackers can exploit this...

IBM Watsonx.Data intelligence log information leakage vulnerability

IBM WatsonX.Data Intelligence is a data management and analysis platform provided by American company IBM. IBM WatsonX.Data Intelligence has a vulnerability related to log information leakage. This vulnerability stems from the disclosure of detailed technical error messages. Attackers can exploit...

IBM Watsonx.Data Intelligence cross-site scripting vulnerability (CNVD-2026-28620)

IBM Watsonx.Data Intelligence is a data management and analysis platform provided by American company IBM. IBM Watsonx.Data Intelligence has a cross-site scripting vulnerability. This vulnerability stems from the application’s lack of effective filtering and escaping of data provided by users...

IBM Watsonx.Data Intelligence Server Request Forgery Vulnerability (CNVD-2026-28621)

IBM WatsonXData Intelligence is a data management and analysis platform provided by American company IBM. IBM WatsonX.Data Intelligence has a server-side request forgeing vulnerability. This vulnerability arises from the lack of sufficient verification mechanisms on the server to confirm the orig...

IBM Watsonx.Data Intelligence cross-site scripting vulnerability

IBM WatsonX.Data Intelligence is a data management and analysis platform provided by American company IBM. IBM WatsonX.Data Intelligence has a cross-site scripting vulnerability. Attackers can exploit this vulnerability to embed arbitrary JavaScript code in the Web UI, thereby altering intended...

CVE-2025-36336

IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques...

CVE-2025-36323

IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2025-36328

IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system...

CVE-2025-36333

IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an authenticated user to perform unauthorized actions due to the improper enforcement of behavioral workflow...

CVE-2025-36321

IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

CVE-2025-12530

IBM watsonx.data intelligence 5.2.2, 5.3.0, 5.3.1, 5.3.1 through Patch 1 transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques...

CVE-2025-12530 Vulnerabilities found in Watson Data Intelligence

IBM watsonx.data intelligence 5.2.2, 5.3.0, 5.3.1, 5.3.1 through Patch 1 transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques...

CVE-2025-12530

IBM watsonx.data intelligence CVE-2025-12530 affects 5.2.2, 5.3.0, 5.3.1, and 5.3.1 through patch-1, where data is transmitted in clear text, enabling potential MITM access to sensitive information. The connected sources provide the affected versions and the clear-text transmission root cause; no...

CVE-2025-36319 Vulnerabilities found in Watson Data Intelligence

IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an authenticated user to cause a temporary denial using a specially crafted HTTP request due to improper allocation of resource throttling...